Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by defaultfuction
CVE-2026-19933 (GCVE-0-2026-19933)
Vulnerability from nvd – Published: 2026-08-16 04:45 – Updated: 2026-08-17 15:40
VLAI
EPSS
VEX
Title
DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
Summary
A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that "it’s being processed".
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:40 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390704 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/390704/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19933 | third-party-advisory |
| https://vuldb.com/submit/872649 | third-party-advisory |
| https://github.com/DefaultFuction/Customer-Relati… | exploitissue-tracking |
| https://github.com/DefaultFuction/Customer-Relati… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Customer-Relationship-Management-In-C-Project |
Affected:
2.0
cpe:2.3:a:defaultfuction:customer-relationship-management-in-c-project:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:40:28.161899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:40:38.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:defaultfuction:customer-relationship-management-in-c-project:*:*:*:*:*:*:*:*"
],
"modules": [
"Customer Search Module"
],
"product": "Customer-Relationship-Management-In-C-Project",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that \"it\u2019s being processed\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T04:45:09.404Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390704 | DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/390704"
},
{
"name": "VDB-390704 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390704/cti"
},
{
"name": "CVE-2026-19933 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19933"
},
{
"name": "Submit #872649 | DefaultFuction CRM V2.0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/872649"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-15T14:10:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19933",
"datePublished": "2026-08-16T04:45:09.404Z",
"dateReserved": "2026-08-15T12:05:46.831Z",
"dateUpdated": "2026-08-17T15:40:38.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19932 (GCVE-0-2026-19932)
Vulnerability from nvd – Published: 2026-08-16 04:15 – Updated: 2026-08-18 14:02
VLAI
EPSS
VEX
Title
DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
Summary
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:02 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390703 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/390703/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19932 | third-party-advisory |
| https://vuldb.com/submit/872648 | third-party-advisory |
| https://github.com/DefaultFuction/Notice-System-M… | exploitissue-tracking |
| https://github.com/DefaultFuction/Notice-System-M… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Notice-System-Managent |
Affected:
2.0
cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19932",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:02:29.744668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:02:43.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:*"
],
"modules": [
"NoticeController"
],
"product": "Notice-System-Managent",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that \"it\u2019s being processed\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T04:15:09.312Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390703 | DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/390703"
},
{
"name": "VDB-390703 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390703/cti"
},
{
"name": "CVE-2026-19932 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19932"
},
{
"name": "Submit #872648 | DefaultFuction Notice System Managent V2.0 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/872648"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Notice-System-Managent/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Notice-System-Managent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-15T14:10:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19932",
"datePublished": "2026-08-16T04:15:09.312Z",
"dateReserved": "2026-08-15T12:05:40.253Z",
"dateUpdated": "2026-08-18T14:02:43.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5333 (GCVE-0-2026-5333)
Vulnerability from nvd – Published: 2026-04-02 13:30 – Updated: 2026-04-02 13:54
VLAI
EPSS
VEX
Title
DefaultFuction Content-Management-System tools.php command injection
Summary
A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-02 13:54 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/354667 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/354667/cti | signaturepermissions-required |
| https://vuldb.com/submit/780849 | third-party-advisory |
| https://github.com/DefaultFuction/Content-Managem… | issue-tracking |
| https://github.com/DefaultFuction/Content-Managem… | exploitissue-tracking |
| https://github.com/DefaultFuction/Content-Managem… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Content-Management-System |
Affected:
1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5333",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-02T13:54:00.449255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:54:13.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Content-Management-System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:30:14.585Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-354667 | DefaultFuction Content-Management-System tools.php command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/354667"
},
{
"name": "VDB-354667 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/354667/cti"
},
{
"name": "Submit #780849 | DefaultFuction CMS V1.0.0 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/780849"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/issues/1"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/issues/1#issue-4082558620"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-01T16:07:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Content-Management-System tools.php command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5333",
"datePublished": "2026-04-02T13:30:14.585Z",
"dateReserved": "2026-04-01T14:01:58.729Z",
"dateUpdated": "2026-04-02T13:54:13.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4623 (GCVE-0-2026-4623)
Vulnerability from nvd – Published: 2026-03-24 01:39 – Updated: 2026-03-24 15:12 X_Open Source
VLAI
EPSS
VEX
Title
DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery
Summary
A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 14:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.352482 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.352482 | signaturepermissions-required |
| https://vuldb.com/?submit.775760 | third-party-advisory |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | exploitissue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | patch |
| https://github.com/DefaultFuction/Jeson-Customer-… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Jeson-Customer-Relationship-Management-System |
Affected:
n/a
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4623",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:11:55.168384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:29.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"API Module"
],
"product": "Jeson-Customer-Relationship-Management-System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T01:39:39.469Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-352482 | DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.352482"
},
{
"name": "VDB-352482 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.352482"
},
{
"name": "Submit #775760 | DefaultFuction CRM V1.0.0 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.775760"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issuecomment-4023480586"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issue-4045330588"
},
{
"tags": [
"patch"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f76e7123fe093b8675f88ec8f71725b0dd186310"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-23T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-23T07:13:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4623",
"datePublished": "2026-03-24T01:39:39.469Z",
"dateReserved": "2026-03-23T06:08:02.864Z",
"dateUpdated": "2026-03-24T15:12:29.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3616 (GCVE-0-2026-3616)
Vulnerability from nvd – Published: 2026-03-06 01:32 – Updated: 2026-03-09 15:30 X_Open Source
VLAI
EPSS
VEX
Title
DefaultFuction Jeson Customer Relationship Management System edit.php sql injection
Summary
A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-09 15:30 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.349234 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.349234 | signaturepermissions-required |
| https://vuldb.com/?submit.765096 | third-party-advisory |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | exploitissue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Jeson Customer Relationship Management System |
Affected:
1.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3616",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T15:30:33.869901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T15:30:41.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jeson Customer Relationship Management System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T01:32:08.323Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349234 | DefaultFuction Jeson Customer Relationship Management System edit.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.349234"
},
{
"name": "VDB-349234 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.349234"
},
{
"name": "Submit #765096 | DefaultFuction Jeson CRM V1.0.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.765096"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812"
},
{
"tags": [
"patch"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-05T19:47:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Jeson Customer Relationship Management System edit.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3616",
"datePublished": "2026-03-06T01:32:08.323Z",
"dateReserved": "2026-03-05T18:42:24.952Z",
"dateUpdated": "2026-03-09T15:30:41.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19933 (GCVE-0-2026-19933)
Vulnerability from cvelistv5 – Published: 2026-08-16 04:45 – Updated: 2026-08-17 15:40
VLAI
EPSS
VEX
Title
DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
Summary
A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that "it’s being processed".
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:40 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390704 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/390704/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19933 | third-party-advisory |
| https://vuldb.com/submit/872649 | third-party-advisory |
| https://github.com/DefaultFuction/Customer-Relati… | exploitissue-tracking |
| https://github.com/DefaultFuction/Customer-Relati… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Customer-Relationship-Management-In-C-Project |
Affected:
2.0
cpe:2.3:a:defaultfuction:customer-relationship-management-in-c-project:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:40:28.161899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:40:38.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:defaultfuction:customer-relationship-management-in-c-project:*:*:*:*:*:*:*:*"
],
"modules": [
"Customer Search Module"
],
"product": "Customer-Relationship-Management-In-C-Project",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that \"it\u2019s being processed\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T04:45:09.404Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390704 | DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/390704"
},
{
"name": "VDB-390704 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390704/cti"
},
{
"name": "CVE-2026-19933 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19933"
},
{
"name": "Submit #872649 | DefaultFuction CRM V2.0 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/872649"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-15T14:10:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19933",
"datePublished": "2026-08-16T04:45:09.404Z",
"dateReserved": "2026-08-15T12:05:46.831Z",
"dateUpdated": "2026-08-17T15:40:38.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19932 (GCVE-0-2026-19932)
Vulnerability from cvelistv5 – Published: 2026-08-16 04:15 – Updated: 2026-08-18 14:02
VLAI
EPSS
VEX
Title
DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
Summary
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:02 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390703 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/390703/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19932 | third-party-advisory |
| https://vuldb.com/submit/872648 | third-party-advisory |
| https://github.com/DefaultFuction/Notice-System-M… | exploitissue-tracking |
| https://github.com/DefaultFuction/Notice-System-M… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Notice-System-Managent |
Affected:
2.0
cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19932",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:02:29.744668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:02:43.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:*"
],
"modules": [
"NoticeController"
],
"product": "Notice-System-Managent",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that \"it\u2019s being processed\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T04:15:09.312Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390703 | DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/390703"
},
{
"name": "VDB-390703 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390703/cti"
},
{
"name": "CVE-2026-19932 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19932"
},
{
"name": "Submit #872648 | DefaultFuction Notice System Managent V2.0 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/872648"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Notice-System-Managent/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Notice-System-Managent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-15T14:10:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19932",
"datePublished": "2026-08-16T04:15:09.312Z",
"dateReserved": "2026-08-15T12:05:40.253Z",
"dateUpdated": "2026-08-18T14:02:43.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5333 (GCVE-0-2026-5333)
Vulnerability from cvelistv5 – Published: 2026-04-02 13:30 – Updated: 2026-04-02 13:54
VLAI
EPSS
VEX
Title
DefaultFuction Content-Management-System tools.php command injection
Summary
A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-02 13:54 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/354667 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/354667/cti | signaturepermissions-required |
| https://vuldb.com/submit/780849 | third-party-advisory |
| https://github.com/DefaultFuction/Content-Managem… | issue-tracking |
| https://github.com/DefaultFuction/Content-Managem… | exploitissue-tracking |
| https://github.com/DefaultFuction/Content-Managem… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Content-Management-System |
Affected:
1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5333",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-02T13:54:00.449255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:54:13.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Content-Management-System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:30:14.585Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-354667 | DefaultFuction Content-Management-System tools.php command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/354667"
},
{
"name": "VDB-354667 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/354667/cti"
},
{
"name": "Submit #780849 | DefaultFuction CMS V1.0.0 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/780849"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/issues/1"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/issues/1#issue-4082558620"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Content-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-01T16:07:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Content-Management-System tools.php command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5333",
"datePublished": "2026-04-02T13:30:14.585Z",
"dateReserved": "2026-04-01T14:01:58.729Z",
"dateUpdated": "2026-04-02T13:54:13.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4623 (GCVE-0-2026-4623)
Vulnerability from cvelistv5 – Published: 2026-03-24 01:39 – Updated: 2026-03-24 15:12 X_Open Source
VLAI
EPSS
VEX
Title
DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery
Summary
A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 14:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.352482 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.352482 | signaturepermissions-required |
| https://vuldb.com/?submit.775760 | third-party-advisory |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | exploitissue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | patch |
| https://github.com/DefaultFuction/Jeson-Customer-… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Jeson-Customer-Relationship-Management-System |
Affected:
n/a
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4623",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:11:55.168384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:29.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"API Module"
],
"product": "Jeson-Customer-Relationship-Management-System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T01:39:39.469Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-352482 | DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.352482"
},
{
"name": "VDB-352482 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.352482"
},
{
"name": "Submit #775760 | DefaultFuction CRM V1.0.0 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.775760"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issuecomment-4023480586"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issue-4045330588"
},
{
"tags": [
"patch"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f76e7123fe093b8675f88ec8f71725b0dd186310"
},
{
"tags": [
"product"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-23T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-23T07:13:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4623",
"datePublished": "2026-03-24T01:39:39.469Z",
"dateReserved": "2026-03-23T06:08:02.864Z",
"dateUpdated": "2026-03-24T15:12:29.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3616 (GCVE-0-2026-3616)
Vulnerability from cvelistv5 – Published: 2026-03-06 01:32 – Updated: 2026-03-09 15:30 X_Open Source
VLAI
EPSS
VEX
Title
DefaultFuction Jeson Customer Relationship Management System edit.php sql injection
Summary
A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-09 15:30 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.349234 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.349234 | signaturepermissions-required |
| https://vuldb.com/?submit.765096 | third-party-advisory |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | issue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | exploitissue-tracking |
| https://github.com/DefaultFuction/Jeson-Customer-… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DefaultFuction | Jeson Customer Relationship Management System |
Affected:
1.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3616",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T15:30:33.869901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T15:30:41.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jeson Customer Relationship Management System",
"vendor": "DefaultFuction",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Practice (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T01:32:08.323Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349234 | DefaultFuction Jeson Customer Relationship Management System edit.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.349234"
},
{
"name": "VDB-349234 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.349234"
},
{
"name": "Submit #765096 | DefaultFuction Jeson CRM V1.0.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.765096"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812"
},
{
"tags": [
"patch"
],
"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-05T19:47:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "DefaultFuction Jeson Customer Relationship Management System edit.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3616",
"datePublished": "2026-03-06T01:32:08.323Z",
"dateReserved": "2026-03-05T18:42:24.952Z",
"dateUpdated": "2026-03-09T15:30:41.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}